A large amount of packet traffic crosses a network at any given moment. Network engineers desire an accurate measurement of network traffic, in order to determine how well the network is operating, and how the network should be provisioned. Network traffic can be viewed as a collection of packet flows. There are various methods for measuring packet flows, including packet sampling and flow caching. Packet sampling involves copying at least a part of a packet and analyzing the copied data. The copied data may include a large portion of the packet's header, and thus may provide information about where the packet came from, where it was going, and/or its size, among other things. Typically, only a selection—for example one out of 5000—packets are sampled. Flow caching involves storing information about packet flows, which can be derived from the packets seen at a network node. The information stored for the packet flows may include information identifying the packet flow, and/or statistics about the packet flow. The information for the packet flow can be analyzed to estimate information about the packet flows, such as how much bandwidth each flow used, how many packets were in the flow, and/or how long the flow lasted.